Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
A reference guide to EC-Council's blue-team network defense certification as it stands in September 2026: the CND v3 program, exam 312-38, the eight blueprint v4.0 domains and their weights, the 20 course modules, eligibility, cost, renewal, the jobs it is hired for, and how it compares to CEH, Security+ and CySA+.
CND is EC-Council's certification for the people who keep a network running and keep attackers out of it. It is the defensive counterpart to CEH.
Where CEH teaches how an attacker gets in, CND teaches how to harden the perimeter, endpoints, applications, data, virtual, cloud and wireless networks so they don't, and then how to detect the intrusion that gets through anyway, respond to it, and predict the next one. The current program is CND v3, tested by exam 312-38 against EC-Council's Exam Blueprint v4.0.
The credential is ANAB accredited under ISO/IEC 17024. EC-Council lists it under DoD 8140 for three DCWF cyber defense work roles (confirm your role on the current matrix). It is issued and maintained by EC-Council, the same body behind CEH, and EC-Council presents it as the step up from Security+ once a job's requirements turn technical.
Five domains, 65% of the exam: defense management, perimeter, endpoints, applications and data, and virtual, cloud and wireless networks.
Incident Detection, 10%: traffic monitoring and analysis, log monitoring and centralized logging.
Incident Response, 10%: the response process, forensics fundamentals, business continuity and disaster recovery.
Incident Prediction, 15%: risk management, attack surface analysis and cyber threat intelligence.
Four things that set CND apart from the other certifications a network or security team might ask you to earn.
Most security certifications either stay at the fundamentals or lean offensive. CND is written for the defender: the administrator who owns the firewalls, the analyst reading the traffic, the responder who gets the call. Every one of its eight domains is about protecting a network, noticing when it's under attack, or getting ahead of the next one.
Windows and Linux hardening, Android and iOS, AWS, Azure and Google Cloud, Docker and Kubernetes, Wireshark and SOAR all appear in the blueprint. Nothing ties the credential to one product line.
Same issuer, same renewal cycle, opposite side of the fight. CEH holders who move into defensive work, and defenders who want the attacker's view, often end up holding both.
EC-Council lists CND as approved under DoD 8140 for three DCWF work roles: 511 Cyber Defense Analyst, 521 Cyber Defense Infrastructure Support Specialist and 531 Cyber Defense Incident Responder. That mapping is EC-Council's, dated May 2024.
The matrix a hiring authority checks is the DoD's own. Confirm your work role and proficiency level on the current DoD 8140 Approved Qualifications Matrix at the DoD Cyber Exchange before you count on it.
The certification, the exam and how to keep it current, as published by EC-Council in September 2026.
Once you hold CND, the next step depends on which of its four phases you want to go deeper on. These are three common follow-ons.
EC-Council's ethical hacking credential, 125 questions over 4 hours. The natural pair for a CND holder who wants to understand the attacks they defend against from the attacker's side. Read the CEH guide.
EC-Council's Computer Hacking Forensic Investigator. CND's Incident Response domain introduces the forensic investigation process; CHFI is where that becomes the whole job.
CompTIA's performance-based analyst exam, up to 85 questions in 165 minutes. Picks up where CND's Detect and Respond phases leave off for people headed into full-time SOC work. Read the CySA+ guide.
CND sits one step above the fundamentals. It assumes you can already run a network and teaches you to defend it, then opens onto the defensive, offensive and leadership tracks.
Build the baseline
Defend the network
Two questions to answer before you commit: can you take the exam, and should you take CND specifically. Here's a straight answer to both.
You can apply to sit the exam without training.
Submit an exam eligibility application to EC-Council documenting at least two years of information security work experience, and pay the non-refundable $100 application fee. Once EC-Council approves it, you buy a voucher and schedule exam 312-38 through the EC-Council exam portal.
Official training waives the requirement.
Complete an EC-Council Accredited Training Center (ATC) course (Training Camp's CND boot camp qualifies) and the experience requirement is automatically waived. Your exam voucher comes with the training, so you can sit for CND immediately after the course finishes.
CND is hired for defensive network and security operations work. These are the six roles it lines up with most directly, including the three DCWF work roles in EC-Council's DoD 8140 mapping (confirm your role on the current matrix):
Designs, configures and maintains firewalls, IDS/IPS, VPNs, segmentation and wireless controls. Five of the eight CND domains sit on the Protect side of the blueprint, which is this job in outline form.
Watches traffic and log data, baselines what normal looks like, and triages what falls outside it. The Incident Detection domain, with Wireshark traffic analysis and centralized log monitoring, maps directly to the first-year analyst's shift.
Runs the switches, routers, servers and endpoints an organization depends on. CND is written for the administrator who already owns the network and is being asked to secure it as well.
Uses data collected from defensive tools to analyze events and mitigate threats. EC-Council maps CND to this DoD Cyber Workforce Framework role; candidates should confirm their role on the current DoD 8140 matrix.
Tests, implements, deploys and administers the infrastructure hardware and software that defensive teams run on. The second DCWF work role in EC-Council's CND mapping, dated May 2024; confirm it on the current DoD 8140 matrix.
Investigates, analyzes and responds to incidents inside the network environment. The Incident Response domain, plus SOAR, EDR and forensics fundamentals, gives the responder a defensible process to follow on a bad day.
The three certifications candidates most often weigh against CND: its offensive sibling, the fundamentals exam most people hold first, and CompTIA's analyst credential.
| CND | CEH | CompTIA Security+ | CompTIA CySA+ | |
|---|---|---|---|---|
| Issuer | EC-Council | EC-Council | CompTIA | CompTIA |
| Current Version | CND v3, exam 312-38 | CEH v13 | SY0-701 | CS0-004 |
| Exam Format | 100 multiple-choice over 4 hours | 125 multiple-choice over 4 hours | Up to 90 questions, multiple-choice and performance-based, 90 minutes | Up to 85 questions, multiple-choice and performance-based, 165 minutes |
| Passing Score | 60% to 85%, set per exam form | 60% to 85%, set per exam form | 750 on a 100 to 900 scale | 750 on a 100 to 900 scale |
| Focus | Defending networks and endpoints, then detecting, responding and predicting | Attacker methodology and tools across 20 modules | Broad security fundamentals across five domains | SOC analyst work: detection, vulnerability management, response, reporting |
| Prerequisites | Official training, or 2 yrs infosec experience + $100 application | Official training, or 2 yrs infosec experience | None required | None required; about 4 yrs recommended |
| Renewal | 120 ECE credits over 3 years + $80 annual fee | 120 ECE credits over 3 years | 50 CEUs over 3 years | 60 CEUs over 3 years |
| DoD 8140 | Listed by EC-Council for DCWF 511, 521, 531; confirm on the current matrix | Approved for multiple DCWF work roles | Approved for multiple DCWF work roles | Approved for 10 DCWF work roles |
| Good Fit For | Network admins and engineers taking on defense; SOC staff | Offensive security, pen testing entry | First security credential, career changers | Full-time SOC analysts on a CompTIA path |
CEH, Security+ and CySA+ facts are taken from the Training Camp guides for CEH, Security+ and CySA+. These certifications overlap but do different jobs, and many defenders end up holding two of them.
Our official EC-Council CND boot camp runs the full CND v3 curriculum over five days, live online or in person, using EC-Council's authorized courseware, with hands-on labs, your exam voucher and a free retake included.
SOC work, zero trust, DoD 8140 and the fundamentals behind the CND domains.
The job CND is built around, without the brochure gloss: alert triage, tier structures, shift patterns, what burns analysts out and what keeps the good ones in the seat. Read this before you decide network defense is the track you want.
CND's perimeter domain now includes zero trust through a software-defined perimeter. This piece walks through what NIST 800-207 actually says, which is narrower and more useful than the marketing version.
The federal memo that turned zero trust from a slide into a set of deadlines. Useful context for anyone defending a government or contractor network.
How a credential gets onto the DoD 8140 Approved Qualifications Matrix, what ANAB accreditation has to do with it, and how to read the matrix yourself instead of trusting a vendor's summary.
A look at the CompTIA options after Security+, and a useful benchmark for deciding whether CND, a vendor-neutral EC-Council credential focused on network defense, is a better next step for the work you want.
A plain explanation of how backdoors get planted, how they persist and what a defender should be watching for in traffic and logs. Good background for the Incident Detection domain.
Awareness training is one of the administrative controls in CND's first domain. This article covers what a program that actually changes behavior looks like, and where most of them fall flat.
Exam Blueprint v4.0 organizes exam 312-38 into eight domains and 20 sub-domains, five questions per sub-domain. The badge shows each domain's share of the exam; the color shows which phase it belongs to. Click any domain for what it covers.
Covers the vocabulary of network attacks, from network, host, application and social engineering techniques through email, mobile, cloud, wireless and supply chain attacks, plus the methodologies attackers follow and the case for defense in depth and a continual, adaptive security strategy. The administrative half covers regulatory frameworks, writing security policies, awareness training, IT asset management and staying current on threats.
Access control models, identity and access management, cryptographic techniques and algorithms, network segmentation, and the core security protocols and solutions a defender relies on. Then firewalls and IDS/IPS in depth: types, topologies, deployment, administration, handling false positives and false negatives, router and switch hardening, and zero trust through a software-defined perimeter.
The heaviest domain, with one sub-domain each for Windows, Linux, mobile and IoT endpoints. Expect Windows baselines, patching, Active Directory and hardening; Linux installation, user access and remote access security; enterprise mobile usage policies and management tools for Android and iOS; and the risks, controls and standards that apply to IoT devices.
Application whitelisting and blacklisting, sandboxing, patch management and web application firewalls on the application side. On the data side, integrity, access controls, encrypting data at rest and in transit (browser to web server, database to web server and email), data masking, backup and retention, data destruction, and data loss prevention.
Security for network virtualization, SDN and NFV, OS virtualization, and containers with Docker and Kubernetes. Cloud fundamentals and how to evaluate a provider before you buy, with specific coverage of AWS, Azure and Google Cloud, plus wireless encryption, authentication and the controls that secure an enterprise wireless network.
Setting up network monitoring, baselining normal versus suspicious traffic signatures, analyzing traffic in Wireshark, and behavior-based anomaly detection alongside performance and bandwidth monitoring. Log monitoring follows, on Windows, Linux and Mac hosts, firewalls, routers and web servers, and then through centralized log collection and analysis.
The response process from the first responder's role and the do's and don'ts of first response through incident handling, automation with SOAR, where EDR, MDR and XDR fit, and the forensic investigation process. Business continuity and disaster recovery cover BC/DR activities, the BCP and DRP documents, the relevant standards and crisis management.
Risk management concepts and frameworks, running a vulnerability management program with assessment and scanning, and privacy impact assessments. Then attack surface analysis, indicators of exposure, attack simulation and surface reduction, and cyber threat intelligence: its types and layers, IoCs versus IoAs, consuming intelligence for proactive defense, and threat hunting.
The official course is organized as 20 modules that follow the blueprint's sub-domains in order. Each badge shows the phase the module belongs to.
Attack terminology and techniques at the network, host, application, email, mobile, cloud, wireless and supply chain layers, and the defense-in-depth strategy that answers them.
Regulatory frameworks and compliance, security policy design, awareness training, IT asset management and staying current on threats.
Access control and IAM, cryptographic techniques and algorithms, network segmentation, and essential network security solutions and protocols.
Firewall types, topologies, deployment and administration; IDS/IPS classification and deployment; router and switch security; zero trust with a software-defined perimeter.
Windows security components and features, baseline configuration, account and password management, patching, hardening and Active Directory security.
Linux installation and patching, OS hardening, user access and password management, network and remote access security, and Linux security tools.
Enterprise mobile usage policies and their risks, mobile security management solutions, and security guidelines and tools for Android and iOS.
IoT ecosystems and communication models, the risks of IoT-enabled environments, security measures, tools and the standards and initiatives that guide IoT security.
Application whitelisting and blacklisting, sandboxing, application patch management and web application firewalls.
Data integrity, access controls, encryption at rest and in transit, data masking, backup and retention, data destruction and data loss prevention.
Virtualization essentials, network virtualization, SDN and NFV security, OS virtualization, and container security across Docker and Kubernetes.
Cloud computing fundamentals, evaluating a cloud service provider for security, and security in AWS, Microsoft Azure and Google Cloud Platform.
Wireless fundamentals, encryption mechanisms, authentication methods and the security measures that protect an enterprise wireless network.
Setting up monitoring, baselining normal and suspicious traffic, analyzing traffic with Wireshark, bandwidth monitoring and behavior-based anomaly detection.
Logging concepts and log analysis on Windows, Linux and Mac hosts, firewalls, routers and web servers, plus centralized log monitoring.
The incident response process, the first responder role, SOAR automation, EDR, MDR and XDR, and the forensic investigation process.
BC/DR activities, the business continuity plan and disaster recovery plan, BC/DR standards and crisis management.
Risk management programs and frameworks, vulnerability management, vulnerability assessment and scanning, and privacy impact assessments.
Understanding and visualizing the attack surface, indicators of exposure, attack simulation and reducing the surface an attacker can reach.
The role and types of threat intelligence, IoCs and IoAs, the layers of intelligence, consuming it for proactive defense, and threat hunting.
Domains, weights and modules reflect EC-Council's CND Exam Blueprint v4.0 (published 2024) for exam 312-38 and the CND v3 program, the version EC-Council administers as of September 2026. No blueprint change is scheduled that we are aware of; confirm on cert.eccouncil.org before you test.
The questions candidates ask most often when researching the Certified Network Defender certification.
CND is EC-Council's blue-team certification for people who protect, monitor and defend networks. The current program is CND v3, tested through exam 312-38 against Exam Blueprint v4.0, which covers eight domains from network defense management and perimeter protection through incident detection, response and prediction. EC-Council positions it as the defensive counterpart to CEH: CEH teaches how attacks work, CND teaches how to stop them and how to know when they're happening.
There are two routes. You can complete official EC-Council training, which qualifies you to sit the exam directly. Or you can apply without training if you have at least two years of information security work experience, in which case EC-Council charges a non-refundable $100 eligibility application fee. Most candidates who take a boot camp use the first route because the training waives the experience requirement.
Exam 312-38 is 100 multiple-choice questions over 4 hours, delivered through the EC-Council exam portal (ECC Exam Center), with remote proctoring available. EC-Council uses multiple exam forms and sets a cut score for each one. In EC-Council's own wording: "Depending on which exam form is challenged, cut scores can range from 60% to 85%." The blueprint allots five questions to each of the 20 sub-domains.
Blueprint v4.0 has eight domains: Network Defense Management 10%, Network Perimeter Protection 10%, Endpoint Protection 20%, Application and Data Protection 10%, Enterprise Virtual, Cloud, and Wireless Network Protection 15%, Incident Detection 10%, Incident Response 10%, and Incident Prediction 15%. Endpoint Protection is the heaviest because it carries four sub-domains: Windows, Linux, mobile and IoT.
EC-Council's store lists the remotely proctored CND exam voucher at $550 as of September 2026. Pricing varies with delivery method and with training bundles, and candidates who skip official training also pay the non-refundable $100 eligibility application fee. Training Camp's boot camp includes the exam voucher and a free retake, so the voucher isn't a separate purchase for boot camp students.
CND falls under EC-Council's continuing education policy: 120 ECE credits over each three-year cycle plus an annual $80 continuing education fee. Credits come from training, conferences, teaching, publishing, volunteering and other approved activities listed in the policy.
They're two sides of the same coin, both from EC-Council. CEH is offensive: it teaches reconnaissance, scanning, exploitation and the attacker's toolset across 20 modules and a 125-question exam. CND is defensive: it teaches perimeter and endpoint hardening, traffic and log monitoring, incident response and threat prediction across its own 20 modules and a 100-question exam. Both renew on the same 120-credit, three-year ECE cycle. Many practitioners hold both; if you work a defensive job, CND matches the day-to-day more closely.
EC-Council lists CND as approved under DoD 8140 for DCWF work roles 511 Cyber Defense Analyst, 521 Cyber Defense Infrastructure Support Specialist and 531 Cyber Defense Incident Responder. That is EC-Council's mapping, dated May 2024. Before relying on it for a position, confirm your work role and proficiency level on the current DoD 8140 Approved Qualifications Matrix at public.cyber.mil, since the matrix is what a hiring authority will check.
Network security engineer, SOC analyst, network administrator with security responsibilities, and the three DCWF roles in EC-Council's May 2024 mapping, which you should confirm on the current DoD 8140 matrix: cyber defense analyst, cyber defense infrastructure support specialist and cyber defense incident responder. It's written for people who already run or watch a network and need to defend it, not for penetration testers.
It's more technical rather than harder in the abstract. Security+ is a 90-minute, up-to-90-question exam covering broad security fundamentals. CND is a 4-hour, 100-question exam that goes deeper on one area: defending networks and endpoints, then detecting, responding to and predicting attacks. EC-Council presents CND as the step up from Security+ when job requirements get more technical, and that's a fair description.
Candidates who already administer networks or work in a SOC generally need 4 to 8 weeks of study at 8 to 12 hours a week, mostly on the domains they don't touch at work. People newer to security often need 10 to 14 weeks. Training Camp's boot camp runs the full CND v3 curriculum over five days with hands-on labs and includes the exam voucher, which works when you arrive with networking fundamentals already in place.
For network administrators, network engineers and SOC staff who want a defensive credential that matches their job, yes. It's ANAB accredited under ISO/IEC 17024, it's mapped by EC-Council to three DCWF cyber defense roles (confirm your role on the current DoD 8140 matrix), and its blueprint covers cloud, container, mobile and IoT defense alongside the traditional perimeter. It's a weaker fit if you want offensive work (look at CEH), a CompTIA-stack path (look at CySA+), or a networking credential rather than a network security one (look at CCNA or Network+).
Tell us where you are, from weighing CND against CEH or CySA+ to working out funding or planning training for a network team, and we'll help you map out the right path.